<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">FYI,<br><br><div>Some related PSS policies for certs, this might impact how we can use PSS.</div><div><br>Begin forwarded message:<br><br></div><blockquote type="cite"><div><b>From:</b> Hubert Kario <<a href="mailto:hkario@redhat.com">hkario@redhat.com</a>><br><b>Date:</b> November 21, 2017 at 09:26:24 EST<br><b>To:</b> mozilla's crypto code discussion list <<a href="mailto:dev-tech-crypto@lists.mozilla.org">dev-tech-crypto@lists.mozilla.org</a>><br><b>Subject:</b> <b>Mozilla RSA-PSS policy</b><br><b>Reply-To:</b> mozilla's crypto code discussion list <<a href="mailto:dev-tech-crypto@lists.mozilla.org">dev-tech-crypto@lists.mozilla.org</a>><br><br></div></blockquote><div><span></span></div><blockquote type="cite"><div><span>In response to comment made by Gervase Markham[1], pointing out that Mozilla </span><br><span>doesn't have an official RSA-PSS usage policy.</span><br><span></span><br><span>This is the thread to discuss it and make a proposal that could be later </span><br><span>included in Mozilla Root Store Policy[2]</span><br><span></span><br><span>I'm proposing the following additions to the Policy (leaving out exactly which </span><br><span>sections this needs to be added, as that's better left for the end of </span><br><span>discussion):</span><br><span></span><br><span> - RSA keys can be used to make RSASSA-PKCS#1 v1.5 or RSASSA-PSS signatures on </span><br><span>issued certificates</span><br><span> - certificates containing RSA parameters can be limited to perform RSASSA-PSS </span><br><span>signatures only by specifying the X.509 Subject Public Key Info algorithm </span><br><span>identifier to RSA-PSS algorithm</span><br><span> - end-entity certificates must not include RSA-PSS parameters in the Public </span><br><span>Key Info Algorithm Identifier - that is, they must not be limited to creating </span><br><span>signatures with only one specific hash algorithm</span><br><span> - issuing certificates may include RSA-PSS parameters in the Public Key Info </span><br><span>Algorithm Identifier, it's recommended that the hash selected matches the </span><br><span>security of the key</span><br><span> - signature hash and the hash used for mask generation must be the same both </span><br><span>in public key parameters in certificate and in signature parameters</span><br><span> - the salt length must equal at least 32 for SHA-256, 48 for SHA-384 and 64 </span><br><span>bytes for SHA-512</span><br><span> - SHA-1 and SHA-224 are not acceptable for use with RSA-PSS algorithm</span><br><span></span><br><span> 1 - <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1400844#c15">https://bugzilla.mozilla.org/show_bug.cgi?id=1400844#c15</a></span><br><span> 2 - <a href="https://www.mozilla.org/en-US/about/governance/policies/security-group/">https://www.mozilla.org/en-US/about/governance/policies/security-group/</a></span><br><span>certs/policy/</span><br><span>-- </span><br><span>Regards,</span><br><span>Hubert Kario</span><br><span>Senior Quality Engineer, QE BaseOS Security team</span><br><span>Web: <a href="http://www.cz.redhat.com">www.cz.redhat.com</a></span><br><span>Red Hat Czech s.r.o., Purkyňova 115, 612 00 Brno, Czech Republic</span></div></blockquote><blockquote type="cite"><div><span>-- </span><br><span>dev-tech-crypto mailing list</span><br><span><a href="mailto:dev-tech-crypto@lists.mozilla.org">dev-tech-crypto@lists.mozilla.org</a></span><br><span><a href="https://lists.mozilla.org/listinfo/dev-tech-crypto">https://lists.mozilla.org/listinfo/dev-tech-crypto</a></span></div></blockquote></body></html>